@sentropic/h2a-runtime@0.91.0
h2a heavy runtime (sessions / k8s / tunnel, node-pty + aws-sdk). Lazily imported by @sentropic/h2a; installed separately.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe static malicious label is not supported by the inspected source. The explicit agent-configuration and installer capability remains risky enough to warn, but there is no concrete unconsented malicious chain.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User runs h2a plugin add/sync or h2a llm-mesh commands.
Impact
A user can intentionally grant configured plugins execution through agent clients; no unconsented activation was found.
Mechanism
User-directed plugin installation, MCP configuration, and local gateway credential handling.
AI rationale
The static malicious label is not supported by the inspected source. The explicit agent-configuration and installer capability remains risky enough to warn, but there is no concrete unconsented malicious chain.
Evidence
package.jsondist/index.jsdist/plugin.jsdist/llm-mesh.jsdist/config.js~/.claude.json~/.codex/config.toml~/.gemini/config/mcp_config.json~/.sentropic/llm-mesh.json~/.sentropic/llm-mesh-token.json
Network endpoints3
oauth2.googleapis.com/tokenauth.openai.com/oauth/tokenlocalhost:3002
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/plugin.js exposes explicit commands that globally install user-selected plugins and register MCP servers in Claude/Codex configs.
- dist/plugin.js supports user-supplied --curl and --install shell commands for remote pod sync.
- dist/llm-mesh.js contains exported helpers that read local Codex, Claude, and Gemini credentials.
Evidence against
- package.json has no preinstall, install, postinstall, or other lifecycle scripts.
- dist/index.js registers plugin and llm-mesh behavior as explicit CLI subcommands; importing the package only defines the CLI.
- llm-mesh enrollment uses an explicit command and a facade flow; local gateway traffic is localhost.
- Observed external fetches are OAuth refresh endpoints, not a package-controlled collector.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
10 flaggeddist/tmux.jsView file
12*/
L13: import { spawn, spawnSync } from "node:child_process";
L14: import { createHash, randomUUID } from "node:crypto";
High
482const bin = c.split(" ")[0];
L483: if (spawnSync("command", ["-v", bin], { shell: true, stdio: "ignore" })
L484: .status === 0) {
High
dist/llm-mesh.js#virtual:normalized:round1View file
399return account;
L400: // Never send a non-OpenAI provider"s refresh token across provider\n // boundaries. In particular, Claude OAuth accounts are not refreshable here.\n if (account.provider !==...
L401: export function readGatewayPid(dir) {
High
Findings
2 Critical8 High3 Medium3 Low
CriticalHardcoded Runtime Data Exfiltrationdist/llm-mesh.js
CriticalPrevious Version Dangerous Deltadist/llm-mesh.js
HighChild Processdist/tmux.js
HighShelldist/tmux.js
HighSame File Env Network Executiondist/llm-mesh.js#virtual:normalized:round1
HighCredential Exfiltrationdist/llm-mesh.js
HighCommand Output Exfiltrationdist/llm-mesh.js#virtual:normalized:round1
HighExternal Ai Agent Control Surface Mutationdist/plugin.js
HighTrigger Reachable Credential Exfiltrationdist/llm-mesh.js
HighTrigger Reachable Command Output Exfiltrationdist/llm-mesh.js#virtual:normalized:round1
MediumNetwork
Affected versions and remediation
This report applies to @sentropic/h2a-runtime@0.91.0.
See all versions of @sentropic/h2a-runtime for other recorded verdicts.
- Review the evidence and your use of @sentropic/h2a-runtime@0.91.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.